Enhanced Due Diligence in KYC AML: Triggers, PEPs and Bank Steps

The short sets up a fair question. Two customers walk into the same branch. One is a salaried employee — fixed monthly credit, local address, ordinary savings account, income that explains every entry. The other has a layered business structure, no clear ultimate owner, transaction volumes that do not match the declared income, and a trading connection to a high-risk jurisdiction. Do both get the same level of checking? Obviously not. What the second one gets is enhanced due diligence, and the exam wants you to know precisely when it kicks in and what it consists of.

KYC runs at three speeds, not one

The single most useful mental model here is that due diligence is a ladder, not a switch. The RBI's Master Direction on Know Your Customer is built on risk-based categorisation — every customer is classified as low, medium or high risk on the basis of identity, financial status, nature of business, geography, the products used and the pattern of transactions. The category then decides how hard the bank looks.

If the middle rung is unfamiliar, read our companion piece on customer due diligence and beneficial ownership first. Enhanced due diligence is not a replacement for CDD; it is CDD plus a second layer bolted on top.

What actually triggers the enhanced layer

Candidates lose marks here by memorising a vague notion of "suspicious customers". The triggers are more specific than that, and most of them are structural rather than behavioural.

• Politically exposed persons and their family members and close associates.
• Complex or opaque ownership structures where the ultimate beneficial owner cannot be established comfortably — layered holdings, nominee shareholders, trusts within trusts.
• Geographic risk — business or counterparties in jurisdictions flagged for weak anti-money-laundering controls.
• Mismatch between declared income and transaction volume. This is the one the short spends most of its time on, and it is the most common real-world trigger.
• Non-face-to-face onboarding. Paragraph 40 of the Direction treats remote account opening as its own category requiring enhanced measures.
• Higher-risk products and channels — cross-border activity, correspondent relationships, high cash intensity.

Politically exposed persons get their own paragraph

A PEP is an individual entrusted with prominent public functions — heads of state or government, senior politicians, senior government, judicial or military officers, senior executives of state-owned corporations, and important political party officials. The classification travels to family members and close associates too, because that is exactly where funds tend to be parked.

Paragraph 41 of the Master Direction does not ban PEP relationships. It conditions them. A bank taking on a PEP must have systems that identify PEP status in the first place, must take reasonable measures to establish the source of funds and source of wealth, must obtain senior management approval before opening the account, and must subject the relationship to ongoing enhanced monitoring afterwards. The same senior management approval is needed if an existing customer subsequently becomes a PEP — a favourite exam variation, because candidates assume the requirement only applies at onboarding.

Remote onboarding is treated as high risk by design

When a customer is never physically seen, the Direction expects the bank to compensate. The Video-based Customer Identification Process is positioned as the first option; where other remote routes are used, the enhanced measures include verified PAN, positive confirmation of the address, restrictions on changing the registered mobile number, and requiring the first transaction to come from an account that is already KYC-compliant. Such accounts are categorised as high risk with closer monitoring until the picture stabilises. The full text sits in the RBI's Master Direction on Know Your Customer.

What the bank must actually do, in order

1. Categorise the risk and record the reasoning. An undocumented category is treated as no category at all.
2. Establish the beneficial owner. The thresholds are worth memorising: more than 10% for companies and partnership firms, more than 15% for unincorporated associations, and 10% or more of beneficial interest for trusts, alongside the settlor, trustees and anyone exercising ultimate control.
3. Verify source of funds and source of wealth. These are two different questions. Where did this particular money come from, and how did this person come to be wealthy at all?
4. Escalate for senior management approval where a PEP or comparable high-risk relationship is involved.
5. Monitor continuously and file a suspicious transaction report where the activity warrants it — without tipping off the customer.

Two sets of numbers ride alongside enhanced due diligence and are asked constantly. Periodic KYC updation runs on a risk-based clock: at least once every two years for high-risk customers, eight years for medium risk and ten years for low risk. And under the PMLA framework reflected in the Direction, transaction records are preserved for at least five years from the date of the transaction, while identification records are kept for at least five years after the business relationship ends.

How this is asked in IIBF certification papers

• Trigger identification. A short case describes a customer; you pick whether standard CDD or the enhanced layer applies.
• PEP conditions. Expect "senior management approval" as the correct option and "prohibited" as the tempting wrong one.
• Beneficial owner thresholds. The 10% and 15% figures are asked directly, and the entity type in the stem decides the answer.
• Periodic updation intervals. Two, eight and ten years — usually scrambled across the options.
• Retention periods. Five years, but note the different starting points for transaction records versus identification records.

The KYC, AML and CFT certification rewards precision more than most IIBF papers, because almost every question maps to a clause rather than to a concept. Run the clause-level questions in our certification mock tests, use the study planner to spread the Master Direction across a fortnight instead of cramming it, and keep the RBI reference page handy for figures that move. More compliance write-ups sit in the blog archive.

Frequently asked questions